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Foreword 


This  paper  provides  a  perspective  on  how  best  to  use  cyberspace  operations  in  support  of 
U.S.  military  operations  in  Afghanistan.  The  authors  describe  the  nature  of  cyberspace  opera¬ 
tions  in  general,  discuss  the  need  for  enhanced  cyberspace  operations  and  express  a  viable  way 
ahead  for  future  cyberspace  operations  in  Afghanistan.  They  posit  that  additional  research  and 
coordination  should  be  conducted  to  better  define  and  develop  requirements  for  cyberspace 
capabilities,  command  and  control  of  cyberspace  operations  and  integration  of  activities  in  a 
manner  that  supports  the  International  Security  Assistance  Force  commander,  the  operations  of 
regional  commanders  and  related  strategic  shaping  and  global  counter  terrorism  pursuit  opera¬ 
tions.  The  lessons  we  learn  now  while  fighting  the  counterinsurgency  (COIN)  fight  will  serve 
us  in  future  conflicts. 

It  has  become  apparent  there  is  more  work  to  be  done  in  exploiting  our  adversaries’  use 
of  cyberspace.  Insurgents  and  members  of  their  supporting  cells  have  been  captured  on  the 
battlefield  with  all  imaginable  types  of  digital  media  and  Internet-capable  devices.  Insurgents 
and  terrorist  organizations  all  have  an  online  presence  that  is  becoming  more  sophisticated  and 
useful  to  their  operations.  Thus,  the  authors  argue  that  it  is  both  clear  and  essential  that  efforts 
to  counter  our  enemies  in  the  Afghan  COIN  fight  must  evolve  and  become  more  effective.  Our 
next  adversary  may  be  well  funded  and  technologically  literate,  originate  from  a  more  educated 
society  and  may  have  developed  a  comprehensive  cyber  operations  doctrine.  This  paper  was 
designed  to  provoke  additional  thought  about  cyberspace  operational  relevance,  suggest  neces¬ 
sary  change  and  enable  future  success  in  Afghanistan  and  future  conflicts. 


Gordon  R.  Sullivan 

General,  U.S.  Army  Retired 

President,  Association  of  the  United  States  Army 


10  April  2013 
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Cyberspace  Operations  in  Support  of 
Counterinsurgency  Operations 


Introduction 

The  United  States  has  fought  an  innovative,  ruthless  and  persistent  enemy  in  Afghanistan 
for  more  than  11  years.  In  response  to  an  evolving  adversary,  the  U.S.  military  developed 
counterinsurgency  (COIN)  doctrine  to  create  a  framework  for  commanders  to  view  their  op¬ 
erational  environment  (OE)  and  provide  new  methods  of  applying  all  the  capabilities  at  their 
disposal.  Comprehensive  COIN  operations  are  the  basis  of  International  Security  Assistance 
Force  (ISAF)  campaign  planning  and  tactical  operations.  While  COIN  provides  a  comprehen¬ 
sive  strategic  framework  to  use  in  defeating  an  insurgency,  it  lacks  any  substantive  analysis 
concerning  the  value  of  employing  cyberspace  operations. 

America’s  enemies  understand  the  power  of  technology.  The  entry  cost  to  using  digital 
communications  is  low  while  the  reliability,  quality  and  simplicity  of  service  are  generally 
high.  Open-source  intelligence  indicates  that  insurgents  use  different  technologies  to  commu¬ 
nicate,  create  operational  plans,  store  institutional  knowledge  and  develop  strategy.  The  full 
extent  of  insurgents’  employment  of  their  technological  portfolio  with  respect  to  command  and 
control,  financing,  recruiting,  training,  propaganda  dissemination  and  knowledge  management 
remains  an  unknown.  These  issues  are  of  particular  concern,  as  they  indicate  a  level  of  sophis¬ 
tication  that  can  enable  and  potentially  enhance  operations  against  coalition  forces.  Present 
insurgent  and/or  terrorist  cyber-based  activities  are  not  fully  understood  at  the  operational  and 
tactical  levels.  The  purpose  of  this  paper  is  to  describe  the  nature  of  cyberspace  operations  in 
general,  discuss  the  need  for  enhanced  cyberspace  operations  in  Afghanistan  and  express  a 
viable  framework  for  how  future  cyberspace  operations  could  be  more  effectively  conducted 
in  Afghanistan. 

Description  of  Cyberspace  Operations 

Cyberspace  operations  provide  support  to  traditional  military  operations  and,  within  some 
rare  cases  and  specific  opportunities,  replace  them.  Technological  solutions,  either  offensive  or 
exploitive,  assist  intelligence  and  operational  planners  in  targeting  individual  insurgents  or  in¬ 
surgent  networks,  operating  within  a  larger  social  network  wherein  they  gain  support  from  the 
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cyber  domain.  By  understanding  the  digital  patterns  of  life  established  by  insurgents  and  sup¬ 
porting  organizations,  U.S.  forces  can  conceptually  develop  enemy  communication  models  and 
better  understand  their  operations  and  tactical  processes.  This  information  improves  friendly 
situational  awareness  and  adds  context  to  existing  knowledge  bases. 

In  some  cases,  cyberspace  operations  can  replace  physical  military  activities  by  support¬ 
ing,  enabling,  informing  and  influencing  activities.  Instead  of  conducting  a  direct-action  raid 
that  can  unduly  risk  maneuver  forces,  a  deceptive  cyber  operation  may  be  more  suitable  to 
shape  the  target,  set  favorable  conditions  for  use  of  kinetic  force  or  disrupt  cohesion  within 
the  network.  Efforts  such  as  these  can  cause  an  adversary  to  commit  a  desired  action  that  will 
provide  a  tactical  advantage  for  U.S.  forces.  Exemplar  cyber  operations  can  cause  a  number 
of  problems,  including  but  not  limited  to  disrupting  target  patterns  of  life,  destroying  trust 
among  key  actors  in  enemy  networks  and  delaying  or  disrupting  logistics  or  financing.  Cyber 
operations  can  provide  a  substantial  military  effect  if  resourced,  coordinated  and  executed 
properly  and  synchronized  with  other  kinetic-  and  non-kinetic-based  effects.  Furthermore, 
these  actions  may  provide  military  planners  with  reflections  across  a  network,  confirming  or 
denying  existing  estimates  about  threat  operational  frameworks  and  insurgent  tactics,  tech¬ 
niques  and  procedures. 

Establishing  Terms  of  Art  and  Science 

In  2008,  senior  military  leaders  within  the  Joint  Chiefs  of  Staff  defined  cyberspace  opera¬ 
tions  and  its  component  parts,  settling  some  of  the  more  contentious  discussions  within  the 
U.S.  cyber  community. 

Cyberspace  operations  are  defined  as  “the  employment  of  cyber  capabilities  where  the 
primary  purpose  is  to  achieve  military  objectives  or  effects  in  or  through  cyberspace.  Such  op¬ 
erations  include  computer  network  operations  and  activities  to  operate  and  defend  the  Global 
Information  Grid.”1  Cyberspace  capabilities  are  comprised  of  many  different  elements — such 
as  computer  software,  networks  and  other  technologies — that  interact  with  digital  or  analog 
communications.  As  described  in  Joint  Publication  3-13,  Information  Operations ,  cyberspace 
operations  consist  of  computer  network  attack  (CNA),  computer  network  exploitation  (CNE) 
and  computer  network  defense  (CND).2 

CNA  is  defined  as  “actions  taken  through  the  use  of  computer  networks  to  disrupt,  deny, 
degrade  or  destroy  information  resident  in  computers  and  computer  networks,  or  the  com¬ 
puters  and  networks  themselves.”3  CNE  is  “enabling  operations  and  intelligence  collection 
capabilities  conducted  through  the  use  of  computer  networks  to  gather  data  from  target  or 
adversary  automated  information  systems  or  networks.”4  Finally,  CND  is  characterized  as  in¬ 
volving  actions  taken  through  the  use  of  computer  networks  to  protect,  monitor,  analyze,  detect 
and  respond  to  unauthorized  activity  within  Department  of  Defense  information  systems  and 
computer  networks.5 

The  Need  for  Agile  Cyberspace  Operations  in  the  Afghanistan  Theater  of  War 

Insurgent  organizations  and  the  larger  supportive  network  have  several  points  of  presence 
on  the  Internet.  Wherever  there  is  access  to  the  Internet,  there  is  the  probability  it  is  being 
used  for  strategic  communication,  information  operations  (IO),  advertisement  for  recruits,  so¬ 
licitation  of  funding  and  ongoing  discussions  by  insurgent  organizations.  The  proliferation  of 
cellular-based  technologies,  particularly  3G  (the  third  generation  of  mobile  communication 
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technology),  has  expanded  insurgents’  capability  sets. 6  The  implication  for  coalition  forces  is 
that  insurgents  will  progressively  gain  greater  access  to  cellular  devices,  some  Internet  capable, 
likely  aiding  them  in  command  and  control  of  their  forces.  Insurgents  will  continue  to  leverage 
these  capabilities  in  opposition  to  coalition  forces,  Afghanistan  National  Security  Forces  and 
the  Government  of  the  Islamic  Republic  of  Afghanistan  (GIRO  A). 

It  would  be  naive  to  think  insurgents  such  as  the  Taliban,  the  Haqqani  Network  or  other 
negative  influences  in  Afghanistan  lack  the  ability  or  interest  to  use  information  technology 
to  increase  their  effectiveness.  The  threats  to  a  stable  Afghanistan  are  comprised  of  different 
factions  with  different  motivations  for  fighting  or  maintaining  instability.  While  they  may  be 
categorized  as  primitive,  cruel,  resourceful  and  committed  to  opposing  the  GIROA  and  coalition 
forces,  they  also  possess  a  superior  cultural  attunement  that  the  coalition  does  not.  Being  poor 
and  uneducated  does  not  equate  to  being  unresourceful,  unintelligent  or  incapable  of  develop¬ 
ing  and  adopting  combat  enablers.  The  events  of  the  Arab  Spring  in  201 1  indicate  the  power  of 
common  technologies  in  countries  with  some  of  the  world’s  lowest  Internet  penetration  levels. 7 


While  the  current  Internet  penetration  level  in  Afghanistan  can  also  be  considered  low, 
there  are  indicators  that  it  may  not  remain  so  in  the  near  future.8  The  following  table  shows 
growth  in  Afghanistan-based  service  providers  and  usage  statistics  from  2010  to  2011: 


1  Table  1 

Telecom 

Statistics  at  the  end 

of  December  201 19 

2010 

2011 

%  Growth 

GSM  Providers  (Licensed) 

4 

4 

0 

GSM  Subscribers 

14,855,235 

17,558,265 

15% 

Internet  Service  Providers 

7 

7 

0 

CDMA  Subscribers 

96,947 

134,092 

27% 

Landlines 

63,533 

80,607 

21% 

Investments  in  $  Millions 

1,563 

1,787 

12.5% 

Telecom  Base  Stations 

3,822 

4,428 

13.6% 

Population  Coverage 

Over  80% 

Over  85% 

5% 

GSM  -  Global  System  for  Mobile  Communication 
CDMA  -  Code  Division  Multiple  Access 


There  is  a  clear  and  growing  consumer  base  for  GSM  and  Internet  services.  Over  the  next 
three  years,  Afghanistan’s  Ministry  of  Communications  and  Information  Technology  (MCIT) 
plans  to  spend  $215.96  million  in  support  of  the  National  E-Afghanistan  Program,  which  “pro¬ 
vides  an  opportunity  to  bridge  the  communications  gap  that  exists  within  the  country  whilst 
also  creating  new  systems  of  data  and  information  management  within  a  model  of  new  public 
management.”10  Since  MCIT  improvements  will  benefit  Afghanistan  as  a  whole,  insurgents 
will  also  be  further  enabled  by  these  improvements. 

Currently,  physical  and  technical  conditions  contribute  to  limits  on  technology  accessi¬ 
bility  in  Afghanistan.  To  some  degree,  these  limitations  hamper  insurgents’  exploitation  of 
this  communication  medium.  Barriers  to  development  range  from  Afghanistan’s  mountainous 
geography  to  poor  information  technology  infrastructure.  Lack  of  technical  expertise  in  the 
Afghan  workforce  may  limit  the  ability  of  insurgents  to  recruit  suitable  technicians  to  support 
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their  operations.  As  access  to  technology  and  the  Internet  improves,  barriers  to  communication 
will  decrease  significantly  and  perhaps  radically.  Metcalf’s  Network  Law  explains  that  user 
networks’  value  expands  geometrically  due  to  the  addition  of  new  nodes.11  Currently,  there 
are  a  number  of  private  Afghanistan-based  efforts  to  increase  overall  access  to  the  Internet 
and  communications  technologies.  Projects  are  in  development  to  emplace  fiber-optic  cables 
to  improve  connection  speeds  and  reliability.  Implementation  plans  and  advertising  exist  for 
3G-  and  General  Packet  Radio  Service-based  networks,  which  will  mark  a  significant  jump  in 
effective  penetration  of  Internet  services.12  Coupled  with  likely  decreases  in  pricing,  the  use 
of  Very  Small  Aperture  Terminals  will  rise  in  more  remote  areas  of  the  country.  While  there 
are  difficulties  in  accessing  Internet  technology,  there  remains  a  strong  desire  to  develop  and 
use  it  in  daily  life,  as  witnessed  by  individuals’  attempts  to  access  the  information  domain  via 
broadcast  radio,  television  and  personal  devices  connected  to  the  Internet.  As  the  information 
environment  in  Afghanistan  becomes  more  accessible,  use  by  insurgents  and  their  supporting 
networks  will  become  routine. 

Cyberspace  Operations  in  Support  of  Counterinsurgency  and  Stability  Operations 
in  Afghanistan 

An  insurgency  is  defined  as  “an  organized  movement  aimed  at  the  overthrow  of  a  con¬ 
stituted  government  through  the  use  of  subversion  and  armed  conflict.”13  In  Afghanistan,  the 
insurgency  is  not  a  monolithic  group  of  Afghan-based  fighters.  Numerous  armed  groups  are 
fighting  for  different  purposes;  some  are  strategic  in  nature,  while  others  have  more  materialistic 
or  self-serving  objectives.  U.S.  and  coalition  forces  are  wading  through  this  shifting  battle¬ 
field  by  creating  innovative  and  effective  solutions  to  complex  problems.  Counterinsurgency  is 
defined  as  “military,  paramilitary,  political,  economic,  psychological  and  civic  actions  taken  by 
a  government  to  defeat  insurgency.”14  Integrating  cyberspace  operations  alone  will  not  pacify 
or  defeat  the  insurgency  in  Afghanistan  but  provides  a  fast-developing  opportunity  for  creating 
significant  effects  in  the  overall  COIN  fight. 

While  no  single  element  of  national  or  international  power  will  decisively  shift  momen¬ 
tum,  cyberspace  operations’  support  to  COIN  will  take  on  increasingly  important  roles.  One 
such  core  role  is  in  complementing  intelligence  operations  to  capitalize  on  the  existing  use 
of  the  Internet  by  insurgents.  Intelligence  support  to  countering  insurgent  use  of  the  Internet 
begins  with  defining  the  OE  though  the  intelligence  preparation  of  the  battlespace  (IPB).15  IPB 
is  “the  systematic,  continuous  process  of  analyzing  the  threat  and  environment  in  a  specific 
geographic  area.”16  To  conduct  effective  cyberspace  operations,  one  must  understand  the  char¬ 
acteristics  and  composition  of  the  social  network  and  the  overall  cyberspace  environment.  A 
cyber  IPB  (CIPB)  is  critical  to  provide  planners  with  the  information  required  to  understand 
and  effectively  target  insurgents  in  the  cyberspace  OE.  Cyber-based  targets  have  a  physical 
presence.  Planners  must  understand  the  physical,  logical  and  persona  layers  affecting  their  bat¬ 
tlespace  in  order  to  conduct  operations. 

Technology  and  its  uses  are  dynamic;  the  constant  change  requires  consistent  observation 
and  evaluation  for  cyberspace  situational  understanding  and  operations.  CIPB  efforts  must  be 
adjusted  to  reflect  changes  to  physical  and  logical  structures  of  the  cyberspace  environment. 
Planners,  to  the  greatest  extent  possible,  must  be  able  to  forecast  expansion,  crossover,  migra¬ 
tion  and  additions  to  the  digital  topology  that  may  affect  U.S.  cyberspace  operations. 

One  solution  to  providing  fiill-spectrum  cyberspace  operational  support  to  COIN  is  to 
have  a  centralized  and  integrated  planning  and  execution  capability  in  theater  to  support  the 
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commander  in  achieving  theater-based  objectives.  Integrated  theater  cyber  operations  increase 
the  risk  to  the  insurgents  using  cyberspace  and  illuminate  their  supporting  actors.  Denying  their 
anonymity,  taking  away  their  “free  pass”  and  creating  active  operational  effects  is  an  important 
component  in  this  fight.  U.S.  Cyber  Command  (USCYBERCOM)  support  must  be  deployed 
in  a  responsive,  compact  organization,  be  granted  the  authority  to  decide  and  act  as  required 
by  the  operational  commander  they  support  and  be  equipped  with  decentralized,  preapproved 
action  capability  at  the  theater  and  regional  command  levels.  There  cannot  be  a  complicated 
system  controlling  all  effects  produced  by  cyberspace  capabilities;  rather,  cyber  operations  and 
effects  need  to  be  timely,  streamlined  and  assured  by  responsive  teams.  U.S.  forces  must  have 
the  ability  to  decide  quickly  on  the  time  and  place  for  use  of  cyber  capabilities  to  disrupt,  deny, 
degrade  or  destroy  an  enemy’s  capacity  to  generate  combat  power  in  the  physical  or  digital 
realm.  A  cyber-based  “fires  net”  concept  will  lead  to  this  capability.17 

General  Gary  Luck,  U.S.  Army  Retired,  and  Colonel  Mike  Findlay,  U.S.  Army  Retired,  de¬ 
veloped  a  concept  to  demonstrate  this  framework.18  Leaders’  main  concerns  about  any  approval 
process  often  center  on  the  amount  of  time  it  takes  for  a  decision  to  be  made.  Tactical  advan¬ 
tages  in  exploiting  emerging  opportunities  are  inherently  linked  to  time;  the  longer  it  takes  to 
make  a  decision,  the  more  quickly  the  advantage  is  lost.  Decentralizing  the  approval  level  and 
collaborating  horizontally  in  a  shorter  time  span  (faster  action  cycles)  will  support  command¬ 
ers  in  achieving  a  tactical  advantage.  Figure  1  on  the  following  page  depicts  the  relationships 
between  decision  and  action. 

In  particular,  USCYBERCOM  must  be  able  to  conduct  CNA  and  CNE  against  targets  on 
the  Joint  Effects  List  to  disrupt  insurgent  network  operations  both  in  Afghanistan  and  globally. 20 
Cyberspace  operations  should  take  a  global  offensive  posture  to  reduce  the  effectiveness  of  in¬ 
surgent  finances,  propaganda  and  command  and  control  efforts.  Additionally,  USCYBERCOM 
should  target  individuals  deemed  to  be  negative  influences,  directly  and  indirectly,  in  order 
to  support  ISAF  and  United  States  Forces-Afghanistan  non-kinetic  operations.  Creation  of 
capacity  to  support  cyberspace  operations  requires  the  design  and  establishment  of  a  robust 
cyber  support  element,  creation  of  an  independent  expeditionary  cyberspace  element  located 
in  Afghanistan  and,  finally,  assigning  to  each  U.S. -led  regional  command  (RC)  an  increased 
digital  network  intelligence  capability. 

Recommendations  for  a  Way  Ahead 

The  agenda  for  implementing  any  significant  change  in  current  operations  must  start  with  a 
suitable  framework  that  includes  adherence  to  the  laws  affecting  cyberspace  operations,  agency 
practices  and  theater  organizational  structures.  None  of  these  changes  or  amendments  is  simple 
or  without  risk.  However,  a  total  reexamination  of  how  USCYBERCOM  and  the  National 
Security  Agency  (NS  A)  conduct  operations  is  required  to  ensure  unity  of  effort  and  to  manage 
efficiently  the  short  supply  of  personnel  and  materials. 

Cyberspace  operations  must  be  responsibly  executed  within  legal  titles  and  authorities 
contained  in  U.S.  law;  however,  there  seems  to  be  an  imbalance  of  evolution.  The  pace  and 
direction  of  technological  developments  quicken  each  day,  yet  the  laws  that  regulate  these 
activities  do  not.  The  law  must  keep  pace  with  technological  developments  to  allow  those 
planning  and  executing  cyberspace  operations  the  flexibility  and  agility  required  to  accom¬ 
plish  their  mission — to  support  warfighting  commanders  with  integrated,  synchronized  cyber 
effects. 
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Figure  1 
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U.S.  Code  Titles  10  and  50  define  the  roles  and  responsibilities  of  the  armed  forces  and 
the  intelligence  community  (IC),  respectively.21  Close  cooperation  and  coordination  would  be 
required  among  USCYBERCOM,  NS  A  and  the  greater  IC  to  leverage  their  unique  capabili¬ 
ties  and  authorities  within  defined  legal  restraints.  While  other  members  of  the  IC  have  a  role 
in  cyberspace  operations,  USCYBERCOM  and  NS  A  retain  the  dominant  amount  of  person¬ 
nel,  capabilities  and  authorities.  The  relationship  between  these  two  organizations  will  largely 
dictate  how  cyberspace  operations  are  conducted.  Differences  in  titles  and  authorities  between 
organizations  are  not  an  insurmountable  obstacle.  The  obstacle  will  be  changing  the  cultures 
and  operational  interaction  between  organizations  in  a  way  that  allows  them  to  collaborate 
within  the  framework  of  their  legal  authorities. 

USCYBERCOM  should  consider  creating  a  continental  United  States  (CONUS)-based 
support  cell  called  the  USCYBERCOM  CONUS  Support  Element,  dedicated  to  providing  con¬ 
tinuous  intelligence,  technical  and  legal  support  to  deployed  CNO  elements.  This  organization 
must  be  staffed  with  military  and  civilian  intelligence  officers  capable  of  providing  a  wide 
range  of  timely  support — including  intelligence,  research,  legal  review  and  interagency  coor¬ 
dination — to  deployed  personnel.  The  authority  to  act  autonomously  within  defined  operational 
parameters  is  critical  to  allow  the  full  range  of  cyberspace  support. 

As  depicted  in  figure  2,  forward-deployed  elements  must  receive  unified,  agile  and  timely 
support  from  all  cyber  operations  stakeholders. 

Expeditionary  Cyber  Operations.  In  any  conflict,  intelligence  enables  operations.  This  concept 
also  holds  true  for  cyberspace  operations.  The  USCYBERCOM  CONUS  Support  Element 
must  collect,  process  and  analyze  data  for  rapid  delivery  to  expeditionary  cyberspace  support 
elements.  This  type  of  support  requires  intelligence  analysts  to  perform  both  technical  and  tradi¬ 
tional  analysis  continuously  because  there  is  no  “off  switch”  for  the  Internet.  Time  zones  do  not 
apply  and  many  interactions  are  asynchronous.  Analysts  must  pay  significant  attention  to  their 
collection  strategy  and  the  sensitive  operations  they  support. 

To  make  the  operational  and  RC-level  cyber  support  elements  more  effective,  they  must 
develop  greater  capabilities  and  operational  reach.  Therefore,  USCYBERCOM  should  develop 
a  Theater  Cyber  Support  Element-Afghanistan  concept.  This  enhanced  organization  would  have 
expanded  authorities  and  capabilities  to  be  leveraged  at  the  direction  of  theater  leadership  under 
coordinated  Title  10  and  Title  50  authorities.  The  following  serves  as  a  potential  model  for  future 
cyber  COIN  operations,  theater/combatant  command  and  joint  task  force/regional  commands. 

The  Theater  Cyber  Support  Element-Afghanistan  would  be  leveraged  to  increase  cyber¬ 
space  operations  supporting  operational  objectives  outlined  by  the  Commander  ISAF  and 
executed  by  RC  teams.  This  commander  must  have  the  ability  to  effectively  direct  cyberspace 
operations  in  his  battlespace.  Additionally,  he  must  be  able  to  conduct  cyberspace  operations 
outside  of  his  physical  battlespace  if  cyber-based  entities  have  a  negative  impact  on  his  OE  or 
ability  to  achieve  his  operational  objectives.  The  cyber  component  of  his  enemy  has  no  physical 
boundaries  or  territory. 

USCYBERCOM’s  goal  should  be  to  enhance  kinetic  and  non-kinetic  operations  in  support 
of  military  information  support  operations,  information  operations,  targeting  and  conventional 
intelligence  operations. 

The  primary  mission  of  the  Theater  Cyber  Support  Element-Afghanistan  would  encom¬ 
pass  three  distinct  areas.  First,  this  organization  needs  the  ability  to  proactively  and  reactively 
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Figure  2 
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counter  insurgent  propaganda.  This  could  be  support  to  IO  or  offensive  cyber  operations. 
Second,  cyberspace  operations  could  include  the  pursuit  of  insurgents  and/or  hierarchical 
structure  in  both  cyber  and  physical  domains.  CNO  should  be  fully  integrated  with  the  tar¬ 
geting  process  to  develop  a  more  complete  picture  of  insurgents’  networks  (personalities, 
finances,  relationships,  etc.).  While  some  of  this  integration  does  occur  on  a  limited  basis,  it 
generally  happens  only  at  the  national  level  and  is  insufficient  to  serve  operational  and  tactical 
commanders  across  the  scope  of  their  mission.  Finally,  the  USCYBERCOM  Theater  Cyber 
Support  Element-Afghanistan  should  establish  cooperation  with  NSA’s  Information  Assurance 
Directorate  to  U.S.  military  communications  providers.  This  relationship  would  provide  RCs 
with  access  to  an  additional  pool  of  CND  expertise. 

This  enhancement  to  cyberspace  operations  could  be  achieved  through  relevant,  measur¬ 
able,  responsive  and  properly  resourced  actions.  The  structure  of  the  Theater  Cyber  Support 
Element-Afghanistan  would  require  specially  trained  individuals  to  perform  a  range  of  duties. 
Among  the  most  important  personnel  requirements  is  assignment  of  digital  network  intelligence 
analysts  and  CNO  planners.  Theater-level  cyberspace  operations  would  require  a  significant 
amount  of  coordination  with  RCs.  RC  cyberspace  planning  cells  would  become  the  conduit  for 
information  flow  from  the  tactical  level  to  the  operational  level. 

RC  cyberspace  planning  cells  should  be  focused  at  the  tactical  level,  targeting  insurgents 
and  their  networks.  These  cells  must  plan  cyberspace  operations  supporting  tactical  objectives 
outlined  by  regional  commands.  The  senior  military  commander  in  an  RC  must  be  able  to 
request  cyberspace  operations  in  his  battlespace  to  shape  kinetic,  non-kinetic  or  intelligence 
operations  in  a  timely  fashion.  As  cyber  operations  are  simply  another  tool,  the  commander 
must  be  able  to  synchronize  tactical  and  operational  cyber  effects  with  the  other  tools  and 
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operations  he  directs.  To  make  major  gains,  cyber  operations  must  be  postured  for  speed  and 
clearly  demonstrate  relevance  to  the  regional  commander. 

RC  cyberspace  planning  cells  should  consist  of  a  basic  CNO  planning  team  capable  of 
conducting  independent  research  to  develop  and  nominate  targets.  At  a  minimum,  RC-focused 
cyber  support  should  include  Digital  Network  Intelligence  and  Dialed  Number  Recognition 
analysts,  an  all-source  intelligence  analyst  and  access  to  all  required  network  connections  and 
tools  used  to  conduct  digital  network  analysis.  With  this  level  of  staffing  and  resources,  the 
RC  cyber  support  teams  would  be  capable  of  conducting  full-spectrum  target  analysis  and 
transmitting  that  information  to  the  theater  cyber  support  element  for  action.  All  prioritization 
and  deconfliction  would  take  place  in  theater  to  rapidly  execute  operations  in  support  of  ISAF 
command  priorities  and  RC  operational  and  tactical  requirements. 

An  Existing  Model  for  Consideration.  The  signals  intelligence  (SIGINT)  community  support 
to  combat  operations  presents  a  viable  model  for  USCYBERCOM  to  provide  commanders 
with  a  responsive  and  deployable  operational  cyberspace  capability.  Through  this  organization, 
the  IC  provides  expeditionary  cryptologic  intelligence  support  from  the  combatant  commander 
down  to  the  division  and  brigade  combat  team  levels  in  Afghanistan.  This  is  accomplished 
through  a  tiered  support  structure  that  delegates  authorities  and  responsibilities  to  SIGINT 
organizations  within  theater  for  specific  mission  areas.  This  concept  of  support  provides  com¬ 
manders  with  responsive  and  focused  intelligence  capabilities  in  a  manner  applicable  to  future 
operational  cyberspace  support. 

Expeditionary  cyberspace  operations  and  SIGINT  have  similar  operational  goals  and  ana¬ 
lytical  tools.  Both  strive  to  provide  support  down  to  the  lowest  level  of  combat  operations  and 
leverage  national  intelligence  capabilities  in  a  manner  consistent  with  U.S.  law  to  achieve 
forward  deployed  forces’  operational  objectives.  The  SIGINT  model  of  support  is  mature  and 
well  tested  and  has  the  confidence  of  military  commanders;  it  is  a  template  for  cyberspace 
forces  to  build  future  policies  and  procedures  and  to  determine  personnel  composition  based 
on  a  structurally  sound  frame. 

Conclusion 

It  is  of  vital  importance  that  the  U.S.  cyber  and  warfighting  communities  be  fully  aware  of 
the  increasing  role  that  cyberspace  operations  can  play  in  Afghanistan.  This  paper  advocates  an 
expanded  approach  in  providing  authority  and  structure  to  the  senior  and  regional  commands 
in  Afghanistan,  as  well  as  integrating  a  more  robust  Cyber  IPB  effort  on  the  part  of  the  broader 
headquarters’  planning  and  operational  efforts.  This  paper  offers  a  usable  template  for  the  future 
organizational  structures  required  to  enhance  current  efforts.  The  challenges  presented  are  not 
difficult  to  overcome,  but  the  will  to  change  the  status  quo  and  embrace  a  different  perspective 
is  necessary.  The  agencies  and  commands  involved  in  supporting  combat  operations  have  dif¬ 
ferent  cultures  and  methods  of  conducting  operations.  Some  organizations  are  responsible  for 
conducting  intelligence  operations  while  others  are  responsible  for  creating  effects  that  support 
strategic  objectives.  The  common  bond  between  them  is  that  the  sum  of  their  actions  provides 
a  tangible  effect  on  the  mission  and  supports  the  warfighter. 
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Glossary 


CDMA 

Code  Division  Multiple  Access 

CIPB 

Cyber  Intelligence  Preparation  of  the  Battlespace 

CNA 

Computer  Network  Attack 

CNE 

Computer  Network  Exploitation 

CND 

Computer  Network  Defense 

CO 

Cyber  Operations 

COIN 

Counterinsurgency 

CONUS 

Continental  United  States 

FM 

Field  Manual 

GCC 

Ground  Component  Commander 

GIROA 

Government  of  the  Islamic  Republic  of  Afghanistan 

GPRS 

General  Packet  Radio  Service 

GSM 

Global  System  for  Mobile  Communication 

IAD 

Information  Assurance  Directorate 

IC 

Intelligence  Community 

IJC 

International  Joint  Command 

10 

Information  Operations 

IPB 

Intelligence  Preparation  of  the  Battlespace 

ISAF 

International  Security  Assistance  Force 

JEF 

Joint  Effects  Fist 

JP 

Joint  Publication 

JTF 

Joint  Task  Force 

MCIT 

Ministry  of  Communications  and  Information  Technology 

NS  A 

National  Security  Agency 

OE 

Operational  Environment 

OPT 

Operational  Planning  Team 

RC 

Regional  Command 

SecDef 

Secretary  of  Defense 

SIGINT 

Signals  Intelligence 

TRADOC 

U.S.  Army  Training  and  Doctrine  Command 

USA 

United  States  Army 

U  SC YBERCOM 

United  States  Cyber  Command 

USMC 

United  States  Marine  Corps 
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